> Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root.

Can you show me a proof of concept here?

If someone has remote root you are telling me they can't unhide a filesystem? Otherwise what are you disputing and what would you accept as evidence?

> If someone has remote root you are telling me they can't unhide a filesystem?

Yes. There is no mechanism at all to unmask the vnode. If you believe otherwise, I'd like to see a proof of concept.

It's absolutely possible. No idea about a proof of concept, but I don't even think it matters, honestly.

It's cute that the OS might play some tricks to hide them from you, but at the end of the day, that's all it is doing, is hiding. Security by obscurity.

You're just betting you hid them really really well and that no one will be able to find them. With zero preparation in the event someone does.

If you have root, you have access to the files, period. Someone determined enough could search, read and write to the disk directly, bypassing the filesystem.

unveil is defense in depth, but it shouldn't be treated as a final line of defense which too many obsd fans seem to want to do.

How? you don't have access to the devices. They're not in your namespace.

Again, proof of concept please.

lol, ok. You really think root can't access the devices? lol.

So you just want to have blind faith in what is basically security via obscurity with extra steps.

That's fine, but it's not an approach to be taken seriously or advocated.

Alright then -- can you tell me what exact sequence of system calls you'd make from a pledged and unveiled process in order to get raw device access?

Right now, you'd need root and a kernel-level exploit to do what you're talking about. I'm not seeing any evidence you have that.

You're just spouting crap.

I'm not spouting crap at all, you just really have your head buried in the sand. YOu've drunk more of the OBSD koolaid then even mac zealots drink of the mac kooolaid.

I won't be replying again as I don't see how this is wroth my time when you can't even support anything you've said.

Again, you haven't given an example of how you'd even open the raw device after you've been unveiled to /home/Zurrrrr/Downloads, and had your syscalls pledged (so, no mknod -- there's no pledge that allows it at all).

You haven't replied the first time to my questions with anything of substance, so what exactly do you mean by "replying again"?

You don’t understand namespaces, there are no mechanisms, or root specific mechanisms, you could use to elevate a namespace.

You don’t get any kind of god powers like kernel memory access, if you don’t have access to the system call you can’t debug.

Like I don’t understand how to explain to you that SELinux locks down system calls in an identical way conceptually.

And I don't think you understand just how many syscalls big third party applications are going to require.

They aren’t (and do not) require any privleged system calls, whatsoever.

If you can actually exploit a system call, neither a MAC based approach or a pledge will help.

> They aren’t (and do not) require any privleged system calls, whatsoever.

You're making a distinction about 'privileged' system calls, why, exactly? You really think something like Oracle won't require access to a ton of syscalls to work correctly?

> If you can actually exploit a system call, neither a MAC based approach or a pledge will help.

MAC will, pledge won't.

For example with SELinux:https://www.kernel.org/doc/Documentation/prctl/seccomp_filte...

Did you realize your link points to a more fragile version of pledge?

Stop spreading misinformation. Hell stop replying to me. You're basically a cultist at this point with your irrational emotional devotion.

That's not a 'weaker version of pledge', it's part of a much larger framework with much greater enforcement capabilities.

I've used it. I know what it does. For a while, I've even run a linux with a slightly patched version of it for some quirky needs of my own.

seccomp-bpf is a more fragile version of pledge; you need to keep changing your sandbox whenever you upgrade glibc, because there's no mechanism to keep syscall usage in sync between the kernel and userspace.

It was fine for my case, because I was implemeting my own direct system calls, and froze any external dependencies, but it's typically very fragile across system and dependency upgrades.

> System call filtering isn't a sandbox. It provides a clearly defined mechanism for minimizing the exposed kernel surface. It is meant to be a tool for sandbox developers to use. Beyond that, policy for logical behavior and information flow should be managed with a combination of other system hardening techniques and, potentially, an LSM of your choosing

Please don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse.

Also, can you please not perpetuate flamewars on HN generally? It's not what this site is for, and destroys what it is for.

I've banned the other account and I'm not banning yours because as far as I can tell you didn't break the rules as badly and you haven't been making a habit of it—but if you'd please review https://news.ycombinator.com/newsguidelines.html and not do this kind of thing in the future, we'd appreciate it.

>Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root.

That statement indicates you do not fully understand pledge(2) and unveil(2).

For example, if you are running Firefox using the default settings as root on OpenBSD. Firefox will not be able to see anything outside of the directories allowed by unveil(2). So an errant JS will not be able to peruse "veiled" Directories. For instance, Firefox cannot see any data in ~/.ssh no matter what ID you are using.

> That statement indicates you do not fully understand pledge(2) and unveil(2).

Not so, not so at all. You have to take my statement in context.

The point was those technologies, while nifty, are entirely irrelevant if an attacker gains remote root.

OpenBSD’s heavy use of pledge, unveil, privilege separation, unprivileged processes, chroot, and strong memory protections do an excellent job of keeping attackers from gaining root.

A car can have all the tech in the world to avoid an accident, but I still expect it to have seatbelts.